feat: add kms_key_id for boot volume encryption and auto-detect security token (RPST) auth

[warisshaikh1]

Summary

This PR adds two related features that are needed to run Kitchen against compartments governed by an OCI Security Zone (which mandates customer-managed encryption) and to authenticate using ephemeral session tokens (RPST) such as those issued in CI pipelines.

1. kms_key_id — customer-managed boot volume encryption

By default OCI encrypts boot volumes with an Oracle-managed key. Security Zone policies often require a customer-managed (Vault) key instead, and instance creation is denied otherwise. A new optional compute config kms_key_id is wired into the InstanceSourceViaImageDetails.kms_key_id of the launch request so the boot volume is encrypted with the supplied key at launch time.

driver:
  name: oci
  kms_key_id: ocid1.key.oc1..aaaaaaaa...

When unset, OCI's default encryption behavior is preserved (the attribute is nil, identical to today's requests).

2. Auto-detect security token (session/RPST) authentication

use_token_auth: true already builds a SecurityTokenSigner. This PR additionally detects token auth automatically when the selected OCI profile contains a security_token_file entry — even if use_token_auth is not set. This makes sessions created by oci session authenticate (and short-lived RPST sessions exchanged in CI) work out of the box, without requiring a user in the profile.

• OCI::Config is always given the security_token_file accessor so the SDK loads it from the profile.
• Api#signer selects the token signer when use_token_auth is set or a usable security_token_file is present.
• The existing use_token_auth flag is unchanged and remains equivalent.

Why

These changes upstream functionality we currently apply as runtime monkey-patches, so consumers can rely on the published gem instead. The KMS option unblocks Security Zone compartments; the token-auth detection unblocks keyless RPST sessions in automated pipelines.

Changes

• lib/kitchen/driver/oci.rb: add default_config :kms_key_id, nil
• lib/kitchen/driver/oci/instance/compute.rb: set kms_key_id on the image source details
• lib/kitchen/driver/oci/config.rb: always expose security_token_file so it loads from the profile
• lib/kitchen/driver/oci/api.rb: auto-detect token auth via security_token_file
• README.md / CHANGELOG.md: document both features; version bump to 3.1.0
• Specs: add KMS launch-request coverage and the (previously missing) token-auth signer coverage, including the auto-detect path

Test plan

• bundle exec rake style — 41 files, no offenses
• bundle exec rake test — 48 examples, 0 failures (was 37)
• Manual end-to-end check: a compute client is built from a profile containing security_token_file and no user, both with use_token_auth: true and via auto-detection
• Backward compatibility: existing launch requests are byte-for-byte unchanged when kms_key_id is unset

[justintsteele]

Acknowledged. Will review this week. Thank you for your submission!